Cloudanix VulnDB

CVE-2026-98852

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel networking bug can cause some IPv6 tunnel traffic to be dropped, which may briefly affect certain network connections until systems are updated.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect IPv6 extension header detection in tunneled packets causes skb_gso_has_extension_hdr and skb_csum_hwoffload_help to mishandle outer Destination Options headers and skb_network_header_len spans, leading to false-positive checksum help calls, warnings, and drops on GSO traffic for ip6_gre, ip6_tunnel, and similar IPv6 tunnels.

Why it matters to the business

Disrupts IPv6 tunneled connectivity and GSO performance in virtualized or encapsulated network environments, potentially causing packet loss until systems are updated; low exploit likelihood reduces immediate urgency but recent publication warrants prompt attention.

How an attack unfolds

An attacker crafts GSO packets carrying outer IPv6 extension headers via tunnels such as ip6_gre or ip6_tunnel; the kernel's flawed encapsulation checks skip proper header validation, invoke checksum help incorrectly, and drop the segments.

How to fix it

Apply the upstream kernel commit that extends ipv6_ext_hdr checks to both outer and inner headers via skb_header_pointer and retains the !encapsulation network-header-length guard; rebuild and deploy updated kernels on affected systems.

How to confirm the fix worked

Generate IPv6 GSO tunnel traffic (ip6_gre, ip6_tunnel, SCTP-in-UDP) and confirm absence of checksum-help warnings or drops; inspect skb_checksum_help call sites and verify skb_header_pointer usage in the patched helper.

Typical attack path

  1. Send GSO IPv6 tunneled packets with outer Destination Options header (encap_limit)
  2. Ensure skb->encapsulation is set or transport_header points incorrectly
  3. Trigger skb_csum_hwoffload_help path on NETIF_F_IPV6_CSUM device
  4. Observe kernel warning and packet drop

How to detect it

Search kernel logs for skb_checksum_help warnings on GSO skbs and unexpected packet drops involving ip6_gre or ip6_tunnel interfaces; correlate with IPv6 extension-header traffic patterns.

What your security team should do

  • Schedule kernel updates for all systems using IPv6 tunneling within the next maintenance window
  • Monitor EPSS trend and kernel mailing lists for backports
  • Test GSO checksum offload paths in lab environments before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: net: extend IPv6 exthdr detection of tunneled packets Commit c4336a07eb6b ("net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback") split skb_gso_has_extension_hdr() into mutually exclusive branches on skb->encapsulation. This did not yet address all paths: 1. With skb->encapsulation set, the outer header is not checked. IPv6 tunnels such as ip6_gre and ip6_tunnel add an outer Destination Options header by default (encap_limit). Their GSO packets skip software GSO, then skb_csum_hwoffload_help() sees the outer extension header and calls skb_checksum_help() on the GSO skb, which warns and drops it. 2. Tunnels over IPv6 without an outer transport header, such as ip6_tunnel, leave skb->transport_header at the inner transport header. skb_network_header_len() then spans the outer IPv6, tunnel and inner IP headers, a false positive. 3. UDP tunnels without an inner network header, such as SCTP-in-UDP or PSP, have no inner IPv6 header to check. Decide on the outer header alone. 4. Directly dereferencing inner_ip_hdr(skb)->version without skb_header_pointer() is unsafe. Instead, check ipv6_ext_hdr(nexthdr) on the outer IPv6 header and, if set, on the inner IPv6 header. Read the headers with skb_header_pointer(). Keep the skb_network_header_len() check when !skb->encapsulation to also catch encapsulated packets without skb->encapsulation (e.g., virtio). Use the same helper in skb_csum_hwoffload_help(). Its open coded test has the false positive of (2) and ignores the inner header. Background: checksum offload of tunneled packets invariants: Non-GSO skb: - If the inner packet is CHECKSUM_PARTIAL, Local Checksum Offload computes the outer checksum in software and the device offloads only the inner L4 checksum. - If the inner packet is CHECKSUM_NONE (e.g., SCTP-in-UDP, ESP-in-UDP, Remote Checksum Offload), the device offloads the outer UDP or GRE checksum instead. GSO skb: - A device with NETIF_F_GSO_UDP_TUNNEL_CSUM or NETIF_F_GSO_GRE_CSUM computes both inner and outer checksums per segment. The outer checksum is seeded with only the pseudo-header checksum. A NETIF_F_IPV6_CSUM device must parse through the outer headers to reach the inner ones.

Affected packages

Ecosystem Package Introduced Fixed